CVE-2013-4122

Publication date 18 July 2013

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

Read the notes from the security team

Status

Package Ubuntu Release Status
cyrus-sasl2 15.04 vivid
Fixed 2.1.26.dfsg1-13ubuntu0.1
14.04 LTS trusty
Not affected
13.04 raring
Fixed 2.1.25.dfsg1-6ubuntu0.1
12.10 quantal
Not affected
12.04 LTS precise
Not affected
10.04 LTS lucid
Not affected

Notes

seth-arnold

NULL return from crypt() if the salt isn't sane Upgraded to medium, bug report shows remote attackers can disable the sasl service by repeating the attack; THREADS=0 configuration is a work-around that may help to prevent abuse.

mdeslaur

eglibc only returns NULL from crypt() in 2.17+, so quantal and older are not affected. 2015-09-25: patch was dropped by mistake in debian's 2.1.26 package, fixed again in 2.1.26.dfsg1-14

References

Related Ubuntu Security Notices (USN)

    • USN-1988-1
    • Cyrus SASL vulnerability
    • 9 October 2013
    • USN-2755-1
    • Cyrus SASL vulnerability
    • 30 September 2015

Other references